{"cve":"CVE-2024-52309","nvd":{"published":"2024-11-21T18:15:12.800","modified":"2026-06-17T08:06:59.253","status":"Deferred","description":"SFTPGo is a full-featured and highly configurable SFTP, HTTP/S, FTP/S and WebDAV server - S3, Google Cloud Storage, Azure Blob. One powerful feature of SFTPGo is the ability to have the EventManager execute scripts or run applications in response to certain events. This feature is very common in all software similar to SFTPGo and is generally unrestricted. However, any SFTPGo administrator with permission to run a script has access to the underlying OS/container with the same permissions as the user running SFTPGo. This is unexpected for some SFTPGo administrators who think that there is a clear distinction between accessing the system shell and accessing the SFTPGo WebAdmin UI. To avoid this confusion, running system commands is disabled by default in 2.6.3, and an allow list has been added so that system administrators configuring SFTPGo must explicitly define which commands are allowed to be configured from the WebAdmin UI.","cvss_v4":{"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","score":5.1},"cvss_v3":null,"cwes":["CWE-20"],"references":["https://github.com/drakkan/sftpgo/commit/88b1850b5806eee81150873d4e565144b21021fb","https://github.com/drakkan/sftpgo/commit/b524da11e9466d05fe03304713ee1c61bb276ec4","https://github.com/drakkan/sftpgo/security/advisories/GHSA-49cc-xrjf-9qf7"],"products":[],"source":"nvd","synced_at":"2026-10-19T21:57:34.731061660+00:00"},"epss":{"cve":"CVE-2024-52309","score":0.0063,"percentile":0.5018,"date":"2026-11-01"},"kev":null,"osv":[{"id":"GHSA-49cc-xrjf-9qf7","url":"https://osv.dev/vulnerability/GHSA-49cc-xrjf-9qf7","summary":"SFTPGo allows administrators to restrict command execution from the EventManager","modified":"2024-12-02T18:04:00Z","packages":[{"ecosystem":"Go","name":"github.com/drakkan/sftpgo/v2","purl":"pkg:golang/github.com/drakkan/sftpgo/v2","ranges":[">=2.4.0 <2.6.3"],"fixed":["2.6.3"]},{"ecosystem":"Go","name":"sftpgo","purl":"pkg:golang/sftpgo","ranges":[">=2.4.0 <2.6.3"],"fixed":["2.6.3"]}]},{"id":"GO-2024-3283","url":"https://osv.dev/vulnerability/GO-2024-3283","summary":"SFTPGo allows administrators to restrict command execution from the EventManager in github.com/drakkan/sftpgo","modified":"2026-03-03T04:56:01.517577Z","packages":[{"ecosystem":"Go","name":"github.com/drakkan/sftpgo","purl":"pkg:golang/github.com/drakkan/sftpgo","ranges":["all versions"],"fixed":[]},{"ecosystem":"Go","name":"github.com/drakkan/sftpgo/v2","purl":"pkg:golang/github.com/drakkan/sftpgo/v2","ranges":[">=2.4.0 <2.6.3"],"fixed":["2.6.3"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}